Legal
Privacy Policy
This policy contains items marked [TO CONFIRM]. Each one is a fact only J K Thomson can supply, or a decision not yet taken. They must all be resolved and this notice removed before the site goes live — a privacy policy that names the wrong legal entity or an unappointed processor is worse than none.
1. Who we are
This site is operated by J K Thomson LLP [TO CONFIRM: legal entity name and company/LLP registration number. The Stripe account is in the name “J K Thomson LLP”, but the site footer currently reads “J K Thomson Ltd”. These cannot both be right.], of Inveresk Mills Industrial Estate, Musselburgh EH21 7UQ, Scotland.
For anything to do with your personal data, contact us at sales@jkthomson.com or on 0131 653 6999.
We are the controller of the personal data described in this policy — we decide what is collected and why.
[TO CONFIRM: ICO registration. Most UK businesses processing personal data electronically must register with the Information Commissioner’s Office and pay the data protection fee. Confirm whether J K Thomson is registered and add the registration number here.]
[TO CONFIRM: whether a Data Protection Officer is required or has been appointed. On the current processing described below it is unlikely to be mandatory, but the position should be recorded.]
2. What we collect
We only collect what we need to take an order, deliver it, and keep proper business records.
- Order and account details — your name, business name, email address and telephone number.
- Delivery address, together with any access or delivery instructions you give us.
- Your chosen delivery date, and any note you add to the order.
- Order history — what you bought, when, and what it cost.
- Correspondence — messages you send us through the contact form, by email or by telephone.
- Technical data — limited information about your visit, described in our Cookie Policy.
We never see or store your card details. Card payments are handled entirely by Stripe. Your card number is sent from your browser directly to Stripe and does not pass through, or get stored on, this website or our servers. We receive only the last four digits, the card brand, and whether the payment succeeded.
3. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Take, process and deliver your order; handle returns and complaints | Performance of a contract with you |
| Send order confirmations and delivery reminder emails | Performance of a contract with you |
| Keep sales and VAT records | Legal obligation |
| Protect the site from spam and fraudulent orders | Legitimate interests — running a secure business |
| Understand which marketing brought you to us | Consent (you can accept or reject this — see our Cookie Policy) |
We do not sell your personal data, and we do not share it with advertising networks.
[TO CONFIRM: marketing email. There is currently no newsletter or mailing list on this site. If one is added, it needs its own opt-in and a description here.]
4. Who we share it with
We use a small number of service providers who process data on our behalf. Each is bound by contract to use it only on our instructions.
| Who | What for | Where |
|---|---|---|
| Stripe Payments Europe, Ltd. | Taking card payments and preventing payment fraud | Ireland / EU, with onward transfers to Stripe, Inc. in the United States under Stripe’s own safeguards |
| Cloudflare, Inc. | Turnstile — checking that our contact form is being used by a person, not a bot | Global |
| [TO CONFIRM: hosting provider] | Hosting this website and its database | [TO CONFIRM] |
| [TO CONFIRM: delivery courier — not yet appointed] | Delivering your order; we pass your name, address and telephone number | [TO CONFIRM] |
| [TO CONFIRM: production email service. The site currently sends mail through a local test tool (Mailpit) which never leaves the development machine. A real sending service must be chosen and named here before launch.] | Sending order and delivery emails | [TO CONFIRM] |
We will also disclose information where we are required to by law, or to establish or defend legal claims.
[TO CONFIRM: international transfers. Once the hosting, courier and email providers are confirmed, check whether any of them process data outside the UK, and if so record the safeguard relied on — UK adequacy regulations or the International Data Transfer Agreement / Addendum.]
5. How long we keep it
[TO CONFIRM: retention periods. As a starting point for discussion — order and VAT records are generally kept for six years after the end of the accounting period to satisfy HMRC; account details for as long as the account is open plus a short grace period; contact form enquiries that do not become orders for a much shorter period, perhaps twelve months. These need to be agreed and then stated here as definite periods, not examples.]
6. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete data where we no longer have a good reason to keep it;
- ask us to restrict how we use it, or object to our using it on the basis of legitimate interests;
- receive certain data in a portable format;
- withdraw consent at any time where we rely on consent — including your cookie choices, which you can change using the Manage cookie consent control at any time.
To exercise any of these, email sales@jkthomson.com. We will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or on 0303 123 1113. We would rather you came to us first so we can put it right.
7. Cookies
How this site uses cookies and similar technologies, what each one does, and how to change your choices, is set out in full in our Cookie Policy.
8. Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top.